Skip to content
Sign in
7.5 High

CVE-2020-12812 Fortinet FortiOS SSL VPN Improper Authentication Vulnerability

Active exploitation observed

· CISA KEV catalogue
Required action Apply updates per vendor instructions.
Ransomware campaigns Known to be used
Weakness CWE-287, CWE-178

Description

An improper authentication vulnerability in SSL VPN in FortiOS 6.4.0, 6.2.0 to 6.2.3, 6.0.9 and below may result in a user being able to log in successfully without being prompted for the second factor of authentication (FortiToken) if they changed the case of their username.

Affected products and versions

Product Affected versions Fixed in
Fortinet FortiOS Versions not published

Other CVEs of Fortinet FortiOS

The 3 CVEs of Fortinet FortiOS →
CVE-2018-13371 An external control of system vulnerability in FortiOS may allow an authenticated, regular user to change the routing… Not rated CVE-2019-5593 Improper permission or value checking in the CLI console may allow a non-privileged user to obtain Fortinet FortiOS… Not rated
Track this CVE